Data security incident information – Updated 290726 at 16:02

Latest updates will be shared on this page as and when further information is available. 

1. What happened?

We recently identified a security issue on a digital service and immediately took steps to contain the incident and activate our incident response procedures.

2. When did the Department for Education become aware?

DfE were made aware after claims appeared over the weekend. Once aware, we invoked our incident response procedures to establish the facts and investigate what had happened.

3. What information may have been affected?

Our investigation has confirmed that the information involved from the Customer Help Portal is limited to customer service contact details for individuals and organisations. The figures referenced relate to lines of data, not the number of people affected.

4.  What is DfE doing about this? 

As a precaution, we have temporarily taken down our Customer Help Portal. The underlying vulnerability has now been identified, and we are working to implement a fix and undertake further assurance checks before we restore full access to the service. 

In line with data protection legislation, a notification of this breach was submitted to the Information Commissioner's Office (ICO)

Protecting customer information remains our highest priority and we will continue to provide updates on this page as and when further information is available.

We apologise for the inconvenience and will provide updates to this document as more information becomes available.

5. What should I be aware of and how can I protect my information?

There are ways you can help protect your information:

• Watch out for any suspicious emails, text messages and websites. There may be fake messages lurking amongst genuine ones that can be very difficult to spot. 
  You can find further information on the National Cyber Security Centre’s (NCSC) website.
• Use strong passwords to protect your accounts.  The ICO have a useful video
• Inform your bank, building society and credit card company of any unusual transactions on your statement.

Data breach guidance for individuals